SMS-receiving numbers

OTP shops put mobile numbers on a shelf. Pick a country and a target app, pay, wait for the code; if it fails, switch. In July 2026 Threat Hunter did not see scattered brokers. We saw searchable, buyable inventory that can be called again after a failed attempt.

Three findings

The point of this brief is not that one-time passwords are weak. It is that an SMS-receiving number is inventory. It is not a number type, the way VoIP is. It comes onto a shelf, leaves it, and can be listed again.

01

Lifespan is bimodal

In 48,222 samples, more than half appear once or have a first-to-last-seen span of 30 days or less. 32.7% are seen again at 90 days or later: 24.8% in the 90–36

02

Price varies more by country

Across 1.177 million valid quotes, the median is $0.43 and 89.3% are at or under $1. Listed prices differ more by country or region than by website or app. We d

03

The shelf is not an attack map

Listed supply covers 234 countries or regions. Social, games, email, and ecommerce are 64.1% of labeled listings. That is what sellers stock, not where attacks

01 Numbers from many countries, one searchable catalog

OTP shops pool numbers from many countries and regions and sort them by origin and by target website or app. Origin, listed apps, and per-use price sit on the same screen.

In this brief, SMS-receiving numbers are mobile numbers pooled by those shops for bulk signup or account verification, then fed into fraud account pipelines. That inventory is what we monitor.

FIG. 1 Shelf excerpt · listed price

Origin and listed price taken from a live catalog. Shop chrome, “get number” controls, supplier IDs, and full numbers are removed. Prices are page quotes at the time of monitoring.

Four roles make the supply work. Delivery is a web checkout or an API call. Numbers that used to sit in separate markets enter one search-and-sale system, and they get replaced when verification fails.

• 01 Number suppliers — Pool mobile numbers from different countries and regions.
• 02 OTP shops — Sort by origin and target service, price the listing, and receive the SMS.
• 03 Distribution — Handle sale and settlement, then deliver the number to the buyer.
• 04 Buyers — Pick a target service, take a number, and switch after a failed check.

FIG. 2 Four roles. The industrial result: scattered numbers → searchable listings → pay-per-use → repeatable calls.

02 Listed supply in 234 countries or regions

In this run, buyable SMS-receiving numbers appeared in 234 countries or regions, across North America, Europe, Southeast Asia, Latin America, the Middle East, and Africa. That figure describes the shop catalog. A number-risk profile should still follow the markets a business actually runs, not the whole shelf.

Country of origin alone does not tell you whether a number came from an OTP shop, or whether it has already been used in bulk.

03 Nearly nine in ten quotes are $1 or less

In about 1.177 million valid quotes, the median is $0.43. The middle 50% sits between $0.25 and $0.66. 89.3% of quotes are at or under $1. These are listed page prices. They are not closing prices, and they are not the full cost of a working account.

On high-stock listings for common websites and apps, median quotes in some countries fall to $0.10–$0.20. All eight countries shown here sit under $0.60. Cheap inventory is not a few-market story. Price gaps track country and region — local stock, telecom cost, what the shop has on sale — more than they track the target app.

04 More than half appear once, or span 30 days or less

Threat Hunter calls the time between the first and last time a number is seen its channel active span. A number seen only once is kept in its own bucket. In 48,222 samples, seen-once is 26.4% and 0–30 days is 29.6% — about 56% together.

At the same time, 90–365 days is 24.8% and 365+ days is 7.9%. Some numbers come back after months or a year. They may be relisted, or put back on the shelf after a pause.

So “fast turnover” does not mean every number is disposable. A static blacklist goes stale in both directions. A number that once sat in an OTP shop is not proof it is still listed. Last-seen, and whether it is on the shelf now, is the usable signal.

05 Social, games, email, and ecommerce are 64.1% of labeled supply

Some shops tag which websites or apps a number is sold against. Threat Hunter found 93,227 labeled supply records. Social and messaging 20.8%, games 14.7%, email and generic accounts 14.6%, ecommerce and retail 14.0% — 64.1% together.

Risks in the table are common abuse patterns inferred from listed use. They are not a confirmed-incident list.

06 How a $0.43 quote turns verification into a repeatable cost

At the median listed quote of $0.43, 100 SMS-receiving attempts cost about $43. That is a page-price sketch. It leaves out failed checks, shop fees, account environment, and later abuse. It is not a confirmed attack.

• 01 Pick a target — Choose the website or app, and the number’s country or region.
• 02 Take a number — Buy it on the page or pull it through an API.
• 03 Receive and submit — Take the OTP and submit it. On failure, switch number or shop.
• 04 Enter the account — Once the check passes, move into the rest of the product.

FIG. 7 A mechanism sketch, not a confirmed event. The risk is not one phone number. It is find, receive, fail, switch — already wired as a loop.

07 Ask last-seen and shop exposure

Wide supply, low price, short spans, and a concentrated shelf point to an operations question. To judge a number, ask three things: has it appeared in an OTP shop, when was it last seen, and has historical risk already reached a hard block.

08 Watch the shop channel, not the number type

Threat Hunter keeps watching numbers that actually enter OTP shops used by fraud operators, and turns first-seen, last-seen, and historical risk into a living profile. The test is not “is this VoIP.” It is “did this number enter a fraud OTP channel.” That finds non-VoIP inventory, and it avoids treating ordinary VoIP as hostile.

SMS-receiving numbers are inventory, not a number type

This brief is not arguing that one-time passwords are weak. It is arguing that an SMS-receiving number is inventory. It is not a number type, the way VoIP is. It comes onto a shelf, leaves it, and can be listed again.

In 48,222 samples, more than half appear once or span 30 days or less. 32.7% return at 90 days or later (24.8% in 90–365 days, 7.9% after a year). A past shop sighting is not a permanent blacklist, and it is not proof the number is dead. Last-seen, and whether it is on the shelf now, is the usable call.

Two more limits sit in the data. Listed prices differ more by country or region than by app; the app gap looks smaller in this run, but that is a quote distribution, not proof that stepping up checks by app value fails. 234 countries or regions is catalog coverage. Social, games, email, and ecommerce at 64.1% of labeled listings is what sellers stock, not where attacks land, and not a reason to build every program against the global shelf.

Source: Threat Hunter monitoring of SMS-receiving platforms, July 2026. Quotes are page snapshots, not closing prices or the full cost of one working account.